The BlackLock ransomware group has become one of the most prolific operators in the Ransomware as a Service (RaaS) ecosystem, with experts warning it could accelerate its growth over the next year.
Also known as El Dorado, BlackLock was ranked as the seventh most active ransomware group based on the number of posts on its data leak site by the end of 2024, marking a 1,425% growth from Q3.
Security firm ReliaQuest recently published research on the group and its rise to prominence, detailing its TTPs and why the operation has seen so much success in recent years.
The group was among the top three most active collectives on the RAMP forum, whose community listed BlackLock among the top ransomware operators in terms of their reputation on the site.
Reliaquest noted that BlackLock’s rise has been both “swift and strategic” and predicted that if the group’s activity continues at this pace it will go on to become the most active ransomware group in 2025.
The group is known to use double extortion tactics whereby they encrypt data while also stealing sensitive information, hoping to exert more pressure on victims with the potential threat of exposing the stolen information.
Its ransomware is custom-built to target Windows, VMWare ESXi, and Linux environments, although Reliquest noted that the Linux variant is less mature than its Windows counterpart.
Why BlackLock stands out from the crowd
The report identifies a number of ways in which BlackLock has set itself apart in what is a highly competitive digital extortion landscape, firstly with what it describes as an unusual leak site that uses a combination of unique tricks aimed at preventing researchers from downloading stolen data.
The site is “packed” with a number of features that Reliaquest speculates are intended to prevent targeted organizations from assessing the scope of their breaches.
“This, in turn, ramps up pressure on the organizations to quickly pay ransoms, often before they can fully evaluate the situation,” researchers said.
“These features also highlight BlackLock’s technical sophistication, reinforcing its reputation as a polished, professional operation.”
RELATED WHITEPAPER
BlackLock’s use of custom-built malware is another indicator of their sophistication, Reliaquest added, which it said is a hallmark of top-tier groups such as Qlin or Play.
Competing groups like Bl00dy, Dragonforce, and RA World rely on externally developed ransomware builders such as leaked versions of Babuk or LockBit, the report notes, whereas BlackLock develops its own bespoke malware.
“While leaked ransomware builders are easy to use, they come with a major drawback: Security researchers can access and dissect the code, find weaknesses, and develop defenses against them. In contrast, BlackLock’s custom malware keeps researchers in the dark — at least until its source code is leaked.”
Reliaquest also reported the group has been actively recruiting affiliates known as ‘traffers’ to support the earlier stages of their attacks, whereas it has been far more discreet when looking to bring higher-level developers on board.
BlackLock targets need to be wary
The report identified potential indicators for BlackLock’s next major targets, citing forum activity that would suggest the group plans on exploiting Microsoft Entra Connect in an upcoming campaign.
A user known to represent BlackLock was found sharing security research on how attackers could abuse Entra Connect’s synchronization mechanism to manipulate user attributes and compromise on-prem environments.
“For organizations managing multiple domains under one tenant, this tactic creates a significant risk of privilege escalation and the potential for a major breach. While the blog describes the attack hypothetically, its feasibility and potential impact make it a serious concern.,” Reliaquest warned.
As a result, organizations should reassess the security of their infrastructure now, Reliaquest urged, stating that in particular, they should look to harden their rules around sensitive attributes, monitor and restrict key registrations, and enforce conditional access policies.
MORE FROM ITPRO
- Life after LockBit: A fragmented landscape and wayward affiliates will still cause chaos for enterprises
- 8Base ransomware members snared in global police crackdown
- Cisco dispels Kraken data breach claims, insists stolen data came from old attack
-
The unseen risk in Microsoft 365: disaster recoveryBusinesses that assume they’re covered for data backup could come unstuck in a time of crisis
-
Anthropic CEO Dario Amodei's prediction about AI in software development is nowhere nearly to becoming a realityNews In March, Anthropic CEO Dario Amodei claimed up to 90% of code would be written by AI within six months – his prediction hasn't quite come to fruition.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million rewardNews The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Cybersecurity experts issue urgent warning amid surge in Stealerium malware attacksNews Proofpoint said Stealerium has flown under the radar for some time now, but researchers have observed a huge spike in activity between May and August this year.
-
Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malwareNews TrendMicro has called for caution on how much detail is disclosed in security advisories
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attackNews The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalitiesNews The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacksNews The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b modelNews Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
